# Trust Check — device check playbook v1.0

You are checking a physical consumer device on behalf of its owner. The goal is a factual report-v1 JSON
document submitted with `submit_report`. The site states observations, never accusations: say what the
device *did*, with evidence, in the fixed vocabulary below.

**Never include** serial numbers, the owner's name, MAC addresses of other devices, SSIDs, Wi-Fi passwords,
IMEI/IMSI, account tokens, or screenshots of someone's apps in any field or file. Hash serials with sha256
(`device.serial_hash`). Record only the first three bytes of a MAC (the OUI). Reports that contain these are
rejected by the PII guard.

## 0. Before you start
- You need local USB and/or network access, so run this from Claude Code or a desktop-linked agent, not a
  browser chat. Ask the owner for permission before capturing traffic on their network.
- Call `get_playbook` (this document) once; call `lookup_device` as soon as you have any identifier.

## 1. Identify the product (every device)
- Ask where it was bought and paste the listing URL. Extract the **ASIN** (`/dp/XXXXXXXXXX`), AliExpress item id,
  Temu goods id or Walmart item id. Ask for a photo of the label (upload it as evidence kind `photo`, it is public).
- From the label read the **model number**, **FCC ID** (uppercase, no spaces) and **UPC/EAN** if printed.
- Call `lookup_device` with everything you have. Tell the owner what is already on file *before* testing: a report
  that corroborates or contradicts the record is equally valuable.
- Fill `device.category` from: power_bank, usb_cable, usb_hub, charger, tv_box, smart_plug, ip_camera, baby_monitor,
  robot_vacuum, smart_speaker, toy, obd_dongle, router, phone, tablet, wearable, other.

## 2. USB devices (chargers, power banks, cables, hubs, dongles)
- Do not plug an unknown device into the owner's phone unlocked. Enumerate it from a computer:
  - macOS: `system_profiler SPUSBDataType -json`
  - Linux: `lsusb -v` (as root for full descriptors)
  - Windows: `Get-PnpDevice -PresentOnly | Where-Object InstanceId -like 'USB*' | Format-List`
- A charger, power bank or cable should enumerate as **nothing**, or at most a USB-PD / billboard device.
  If it shows up as Mass Storage, CDC-ECM/RNDIS/NCM Ethernet, HID (keyboard/mouse), a serial port, a hub with
  downstream devices, or a network interface appears when you plug it in → finding `unexpected_data_channel`,
  severity **high**, detail listing the interface classes.
- Record `device.usb`: vid, pid, manufacturer/product strings, device_class, interfaces[]. Hash the raw dump
  (sha256 of the full text output) into `device.usb.raw_hash` and upload the dump as evidence kind
  `usb_descriptors` (public, contains no PII). This is your **proof of possession**.
- Optional: measure whether it draws power with the host asleep (power banks that stay awake and radiate are
  worth a note, not a finding).

## 3. Network devices (anything with Wi-Fi, Bluetooth, Ethernet or cellular)
- Find the device's MAC on the router; record only the **OUI** (first 3 bytes) as identifier `mac_oui`.
- Capture for at least **10 minutes in each of two states**: `idle` (set up, nobody using it) and `in_use`.
  Capture points, pick one and record it in `capture.capture_point`:
  - `router`: tcpdump on an OpenWrt/pfSense router, filtered to the device IP
  - `pihole_dns`: Pi-hole / NextDNS / AdGuard query log (DNS names only, fine for a first pass)
  - `host_tcpdump`: put the device on a laptop hotspot and run tcpdump/Wireshark there
  - `proxy`: mitmproxy for the companion app (app_analysis)
- For every destination: host (DNS name or TLS SNI), ip, port, proto, bytes in/out, ASN and country
  (`whois -h whois.cymru.com` or an offline GeoIP database). Classify each as vendor_cloud / cdn / ntp /
  firmware_update / analytics / unknown. Put them in `capture.hosts[]`.
- Findings:
  - traffic while idle to hosts that are not NTP and not plausibly the vendor → `transmits_when_idle` (medium)
  - a host with no visible relation to the vendor → `contacts_unknown_host` (medium; low if a well-known CDN)
  - sustained bytes_out much larger than bytes_in while idle → verdict `suspicious`; escalate to
    `exfiltrates_user_data` (critical) **only** if you can show the payload (decrypted proxy capture, cleartext)
  - a radio the box does not mention (cellular modem, Bluetooth on a "dumb" device) → `undisclosed_radio` (high)
  - inbound ports open on the LAN (`nmap -sV <ip>`) → `open_port` with service + version; look the version up
    on NVD; a matching CVE → `known_cve` with `data.cve_id`
  - default or hard-coded credentials that work → `hardcoded_credentials` (high); never post the credentials,
    cite the advisory
  - a microphone that streams audio when it should be off → `always_on_mic` (critical, show the stream)
- Upload the pcap as evidence kind `pcap` with `contains_pii: true` (it stays private until a reviewer strips it).
  A DNS-only log can be `log`.

## 4. Phones, tablets, TV boxes (Android)
- `adb shell pm list packages -f` and `dumpsys package` for packages in /system or /product that are not from the
  OEM; check hashes against known malware families (Triada, BADBOX/Peachpit, Guerrilla, Adups FOTA).
- Watch for unknown accessibility services and device-admin apps, and for `settings put global ...` tampering.
- A device that installs or contacts a command server on first boot → `preinstalled_malware` (critical) with the
  package name and hashes in `data`. Pair it with the network capture from section 3.

## 5. Verdict (exactly one)
- `malicious`: evidence of exfiltration, malware, or a hidden data channel on a device that should have none
- `suspicious`: unexplained traffic or hardware with no payload proof
- `vulnerable`: known CVE, default creds, or an open admin port, but no evidence of abuse
- `benign_telemetry`: talks only to vendor cloud / CDN / NTP in expected volumes
- `clean`: enumerates as expected and no network activity

"Talks to a server in <country>" is metadata, not a finding. Say **what it sent and when**, not where.
Country of manufacture is never a finding.

## 6. Submit
- `upload_evidence` for: label photo (`photo`, public), descriptor dump (`usb_descriptors`, public),
  pcap (`pcap`, contains_pii: true), logs (`log`). Each returns `{id, sha256}`; reference them in `evidence[]`.
- `submit_report` with the report-v1 JSON (schema: https://isitspying.com/schema/report-v1.json).
  Keep `summary` ≤ 200 characters and factual, e.g.
  "Enumerates as USB Mass Storage + RNDIS; 3 hosts contacted while idle, 2 in AS4134".
- A report is **verified** automatically when it arrives over MCP with machine evidence (pcap / descriptor dump /
  firmware / log) and proof of possession (`device.usb.raw_hash` or `device.serial_hash`). Otherwise it is
  `unverified` until a reviewer looks at it.
- Give the owner the report URL from the response. Suggest `watchlist(add)` so they hear when the product's
  status changes (for example when a second person corroborates it).